Azure VM backups

I’ve previously detailed how you can use Azure Backup to backup desktops as well as servers here:

Which basically does files and folders but in such a way that only the differential changes are sent each time. The question for many IT Pros is how do I recover a complete Azure VM like I can on premises using my traditional disk imaging tools?

The good news is that Azure now has such a services called Azure VM Backup and here’s how to use it.

Best practice is probably to go in and create a new Backup Vault in Azure to ensure you know what storage ‘bucket’ these backups are in. This is because you can back up a lot of different things using Azure services.

It will take a few moments for the new Backup Vault to spin up once you have selected a region for it. Which region you select is important because you can, by default at the moment, only backup VMs from the same region.

Once the new Backup Vault is ready select it, then select Registered Items from the menu across the top. Ensure that the type is set to Azure Virtual Machines and then select the Register link at the bottom of the page.

Place a check in the VM(s) you wish to backup. Then select the check icon in the lower right to save the configuration.

The machine you selected will then be ‘registered’ This means it will have the appropriate configurations made to allow it to be backed up. The VM will need to be running during this process or the registration will fail.

If you now select the Jobs option from the menu you should see the registration process proceeding. The registration should take around 5 minutes but may vary on what type of VM you are backing up.

If you now return to the Registered Items menu option you should see your machine listed as shown above.

With that machine still selected, you will see a number of buttons at the bottom of the page. Select the Protect button to commence a backup of this VM.

Select the items to protect and press the continue arrow in the bottom right of the window.

You’ll then be prompted to create a protection policy. Best policy is to create a new policy, given it a meaningful name and then select the backup frequency.

At this point in the time the most frequently you can backup a VM using this process is once a day.

After you have selected an appropriate Retention Range, select the check to save the settings.

If you wish to do an immediate backup at any time outside the configured schedule, select the Protected Items from the menu at the top of the page.

Ensuring that the desired VM is selected, press the Backup Now button at the bottom of the page.

If you return to the Jobs menu you should see a new job that is “InProgress” as shown above and the Operation is “Backup”.

The VM being backed up of course needs to remain up and accessible during this process.

Even though you can’t schedule backups more frequently than once a day via the browser I’m betting you can via PowerShell and perhaps even use the automated Run Book features of Azure to do this.

The VM you are backing up continues to run as normal and I saw no performance impact occur in this test environment during the process. That may of course vary depending on loads and amount of data to be backed up of course.

From – https://azure.microsoft.com/en-us/documentation/articles/backup-azure-vms-introduction/

How does Azure virtual machine backup work?

To back up a virtual machine, first a point-in-time snapshot of the data is needed. The Azure Backup service initiates the backup job at the scheduled time, and triggers the backup extension to take a snapshot. The backup extension coordinates with the in-guest VSS service to achieve consistency, and invokes the blob snapshot API of the Azure Storage service once consistency has been reached. This is done to get a consistent snapshot of the disks of the virtual machine, without having to shut it down.

After the snapshot has been taken, the data is transferred by the Azure Backup service to the backup vault. The service takes care of identifying and transferring only the blocks that have changed from the last backup – making the backups storage efficient. When the data transfer is completed, the snapshot is removed and a recovery point is created. This recovery point can be seen in the Azure management portal.

Azure virtual machine backup architecture

So as a I test I used Azure VM Backup to initially backup a Windows 10 machine with Office 2016 installed. That took 37 minutes. Immediately after that backup completed I run another and it took 23 minutes. The Windows 10 system reported about 25 GB of total used space.

Now, what happens when you want to restore? Basically you’ll be restoring the whole machine to a new VM. The current preview of Azure VM Backup doesn’t permit restoring to the original VM, however I’m sure down the track that will become available.

To restore your VM go to the Protected Items options from the menu and ensure the machine you wish to restore is selected.

From the button at the bottom of the page select Restore.

Select a recovery point from the list (this is basically all the backups you have performed). Press the continue arrow in the lower right to continue.

You now need to give the restored VM a name (it can’t be the same as an existing machine so if the original still exists you’ll need to delete it first as source over writing is not yet available).

You’ll also need to select a storage account, virtual network and subnet.

Once you have done that select the check icon in the lower right to commence the restore process.

If you go and check the Jobs option again you should see a restore job in progress as shown above.

For me, after only 8 minutes the restore job completed (that is for a 25GB of data) and if you now look in your Azure Virtual Machines you will see the item your restored, just as it was when you backed it up.

Azure VM Backups are still in preview and there some limits on what features are not available as yet. You’ll find that details in this blog post:

http://azure.microsoft.com/blog/2015/03/26/azure-backup-announcing-support-for-backup-of-azure-iaas-vms/

Most of the limitations I would expect to disappear in a very short space of time. That is going to make Azure VM Backup a pretty powerful option for your Azure IaaS solutions.

Here are some additional articles with more details about:

Introduction to Azure VM Backups

Backing up with Azure VM Backup

Restoring with Azure VM Backup

So now you can use Azure to backup up you Azure VMs as you would have typically done on premises using imaging software. Using Azure VM Backup is going to however provide improved ease of use and scalability as well as the ability to more rapidly improve than an existing on premises options.

Azure VM Backup is yet another example of the power the cloud is bringing to traditional infrastructure by making it easier and better.

Azure AD Sync Services tool–the basics

The most popular post on my blog is currently:

Windows Azure Active Directory Sync tool (DIRSYNC) – the basics

The currently recommended tool for syncing your on premises AD to Office 365 is now is not DIRSYNC but:

Azure AD Sync Services

There is a further updated version that is currently in preview called:

Azure AD Connect

and you can read more about that preview here:

Azure AD Connect Preview 2 is available

I’ll do a blog post on that very soon, but for now let’s concentrate on what is generally available.

You can read more about Azure Active Directory Sync here:

https://msdn.microsoft.com/en-us/library/azure/dn790204.aspx

Firstly, download the tool from the link above. In this case I am installing on clean AD and I’m also going to install the tool onto a domain controller, which is supported but not best practice. I am also using a new demo empty Office 365 E3 tenant.

After you have made sure your on premises AD is in good health, and before installing the sync tool on your network, you should login to your Office 365 tenant as a global administrator and navigate to the Admin portal.

You then need to select the Active Users option from beneath the Users menu item from the option on the left of the Office 365 Admin portal.

Note: that I have no users apart from the Global Administrator in my new Office 365 tenant initially.

At the top of the Active Users dashboard you will see an option called Active Directory synchronization as shown above. Select the Set up hyperlink to the right.

This will then present you with a number of steps. You should complete Steps 1 and 2, which I have already completed.

Then select the Activate button under option 3.

You’ll then be prompted to confirm you do want to proceed with synchronization. Note the warnings and select the Activate button to proceed.

You should now see that option 3 displays Active Directory synchronization is activated as shown above.

Return to your on premises sync server and double click on the package you downloaded. It will be extracted.

Double click the icon it places on the desktop to commence the configuration process.

You are prompted for the location to install the software. The default location is:

c:\program files\microsoft azure ad sync

You can however change this if desired.

When you have entered in the appropriate installation directory and checked the I agree to the license terms box, you can select the Install button in the lower right hand corner.

You will now see the program install the files to the installation directory as shown above.

You will then see Microsoft SQL Express being installed. Having SQL on a domain controller is generally not best practice but is supported now. However, beware that they sync tool will install and use SQL Express by default.

You will then see it installing the actual Sync Service on your machine.

Amongst a few other Azure services installed on your machine you’ll now find the Microsoft Azure AD Sync service as shown above.

You’ll then be prompted to enter you details for Azure AD as shown above.

Remember, Office 365 is built on Azure AD and uses it to manage identity. Thus, here you now enter your Office 365 global administrator credentials.

Best practice is to use a dedicated global administration account that has not been assigned any licenses. That is, create a new user and make then a global administrator but don’t assign them a license in your Office 365. Then only use this user to synchronise your local AD to Office 365.

Here, I am am just going to use the default tenant administrator to keep it simple but importantly, the user you enter here MUST have the Office 365 Global Administration role.

When you have completed the required details here press the Next button to proceed.

The provided login will then be authenticated.

If you have not as yet enabled directory synchronization in your Office 365 tenant, as detailed previously, you will see the above error message.

You will be prompted to enable this before you can proceed further.

You’ll then be prompted for a local forest (domain) and domain administrator as shown above.

If you look at your local Active Directory Users and Computers you will normally find the forest name at the top of the tree. In this case it is kumoalliance.org.

Note, that you need to have users assigned to routable domain locally as their primary UPN, not something like .local or .lan. if they are, then you will need to change this prior to synchronisation or otherwise users won’t end up correctly in Office 365.

Take a look at this article:

How to synchronize a .local domain

on how to perform update your users if you only have a .local domain.

Also note here that I have four users in my local domain also shown above.

When the correct local domain administration credentials have been entered select the Add Forest button.

If that is successful you should see you domain listed below teh entry fields now as shown above.

Select the Next button to proceed.

You should now see the connector from your local AD to Azure being created and configured as shown above.

You are now given the options to match local users to Azure AD users if they exist. This will basically match on premise AD objects to those already in Azure AD.

Because there are currently no users in my Office 365 tenant there are none that require matching so best practice is to leave the default options configured and select the Next button to continue but as you can see, you can match users between your local AD and the cloud via a variety of options.

Remember again, that my Office 365 tenant is empty except for the default admin account as shown above.

You are now presented with the Optional features page. You can learn more about the options here at:

https://msdn.microsoft.com/en-us/library/azure/dn757602.aspx#BKMK_ConfigureSynchronizationOptions

Where many get confused is the difference between Password write-back and Password synchronization. Password write-back is an Azure Active Directory Premium feature. For more information on how to configure this, see:

Password writeback: how to configure Azure AD to amange on-premises passwords

and

http://blogs.technet.com/b/ad/archive/2014/04/29/deep-dive-password-reset-with-on-premise-sync-in-azure-ad-premium.aspx

Office 365 currently doesn’t include Azure AD Premium so the only option available is Password synchronization which you should select. More information on password synchronization can be found here:

https://msdn.microsoft.com/en-us/library/azure/dn835016.aspx

Remember, Azure AD sync allows the connection of more than just Office 365 to your local AD, that’s why there are more options here.

The new sync tool, Azure AD Connect, that is in preview, will support password writeback as the above blog post highlights towards the end of the post. As I said, I will also do a post on this soon.

So, in summary here, select Password synchronization and then the Next button to continue.

You can now review the information and when ready select the Configure button to continue.

The tool will now complete the configuration and enable the options you select. You see it connecting as shown above.

You will then see it enable the options you selected with any issues or errors highlighted.

When the process is complete you’ll have the option to Synchronize now, which you can uncheck if desired. Remember, this first sync may be quite large and take some time depending on how many objects are being copied to Office 365.

However, in most cases, you’ll leave this option checked and select the Finish button.

In a very short period of time you should see your users appear in the Office 365 console as shown above.

However, importantly, they will not have a license assigned to them so they won’t have things like a mailbox yet.

Why is that? Remember you can have many different types of licenses in Office 365 and you can allocate them to different users as you please. The sync client doesn’t know which licenses you want applied to which user so they need to be applied manually.

If all the users are going to get the same license simply select all the users in bulk as shown above, then select the Activate synced users hyperlink in the lower right hand side.

Then assign the location and license you want to apply to these users and select the Activate button at the bottom of the screen.

The process is now complete. Your local AD users are now synced to Office 365 using Azure Azure Sync Services. If they change their password on premises it is also synced using password hashing to Office 365.

Points to remember with Azure AD Sync (and DIRSYNC for that matter):

– By default, passwords changed in the cloud are overwritten when the next sync from on premises AD occurs.

– Information is copied from local AD to Office 365 not back. That is, the way it was installed above, it is a one way sync from on premises to Office 365.

– Owners of an on-premises distribution group that’s synced to Office 365 can’t manage the distribution group in Exchange Online

– Azure AD Sync services allow the configuration of object filtering

– Changes are synchronized based on a three hours interval (this is the same interval that is also used by DirSync). There is a scheduled task running as the service account which will run the cycle. If you unselected “synchronize changes now” during installation then the task is installed as “disabled”. You can force synchronization using a PowerShell command if required as well as running the following file:

C:\Program Files\Microsoft Azure AD Sync\Bin\directorysyncclientcmd.exe

– You can upgrade from DIRSYNC to Azure AD Sync Services

– The new Azure AD Connect tool is due soon with more features (blog post on that coming soon)

You’ll also find some tools installed on your sync machine to help manage and troubleshoot the sync process.

Like the Synchronization Service Manager show above that give you a low level insight into what the sync is actually doing. More on that again in an upcoming post.

Revised bootcamp notes publication now available

As I detailed a while back I have now updated my Bootcamp products offering to include:

1. Latest version of my Office 365 bootcamp notes. This OneNote notebook is something I use everyday to capture information about Office 365. It is my reference ‘bible’ covering everything from Exchange to Sharepoint, Delve to Single Sign on as well as troubleshooting, best practices and a range of PowerShell scripts and third party solutions that work with Office 365.

2. Latest version of my Azure bootcamp notes. This OneNote notebook contains my daily brain dump about Azure. It contains links, information, tutorials and more. Again, this is something I use everyday and update constantly.

3. Exam cram notes for the Office 365 70-347 and 70-346 exam. It contains information and links to help you pass the exam. It also has a number of practice exam questions to give you an idea of what might be covered in an exam.

4. Five (5) supporting Office 365 checklists and templates that you can use for your Office 365 implementation. These documents are in various Office formats (Word, Excel, etc).

There are two ways to get access to this material:

1. You can join my Cloud Business Blueprint community via:

http://www.cloudbusinessblueprint.com/members-sign-up/

where you’ll get immediate access to the latest versions plus heaps of other unique on demand training, cheat sheets, re-brandable content, articles AND access to the members forums to converse with other cloud resellers.

2. You can purchase the existing Office 365 bootcamp notes via;

http://www.e-junkie.com/ciaops/product/488325.php

for AU $148. This purchase will also entitle you to a 12 monthly subscription for updates to these products (generally updated monthly).

Also, given that the 74-325 Office for SMB exam has been superseded I have made the OneNote exam cram notes I created for this available for free download with all my other free material at:

http://www.ciaops.com/downloads

If nothing else, those bootcamp notes are going to provide a centralised and searchable way to locate just about anything to do with Office 365 and Azure. This will save you inordinate amounts of time and easily pay for your outlay. You’ll also get free updates for to all of these for 12 months once you purchase. Like I said, I use these notebooks EVERY DAY.

If you want some testimonials about these bootcamps and information provided visit:

http://www.ciaops.com/bootcamp/

Please support this material so I can continue creating more.

Need to know podcast–Episode 83

In this episode I’m joined by a real SharePoint and Office 365 rockstar (who also happens to be an MVP) – Benjamin Niaulin.

Benjamin shares his insights and experiences from the recent Microsoft Ignite Conference. We then deep dive into the new Office 365 Groups and how important they are becoming to the service overall. Finally, I couldn’t let Benjamin escape with out providing some guidance around SharePoint migrations.

A huge amount of value in this episode from a doyen of the community, so don’t miss it. You can listen to the episode at:

http://ciaops.podbean.com/e/episode-83-benjamin-niaulin/

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show. I’m also on the hunt for some co-presenters so if you are interested on being a regular part of the show please contact me.

Resources

Microsoft Ignite on demand – http://channel9.msdn.com/events/Ignite/2015/

Blogging comes to Delve – https://blog.ciaops.com/2015/05/blogging-comes-to-delve.html

New OneDrive Sync client – https://blog.ciaops.com/2015/05/more-onedrive-information-from-ignite.html

Mobile device management – https://blog.ciaops.com/2015/05/mobile-device-management-has.html

Offline Azure backup – https://blog.ciaops.com/2015/05/offline-azure-backup.html

Sharegate – http://en.share-gate.com/

Sharegate blog – http://en.share-gate.com/blog/

Benjamin Niaulin – https://twitter.com/bniaulin

Webinar on Office 365 Groups – http://en.share-gate.com/blog/groups-for-office-365-webinar

Benjamin’s wrap up of Microsoft Ignite – http://en.share-gate.com/blog/ignite-collaboration-in-a-modern-workplace-transformed

Office 365 data import service rolling out

Here’s an interesting item from the Office 365 Roadmap in development.

Drive Shipping and Network Based Data Import for Office 365

The ability to import data into Office 365 in a quick and easy manner has been a known constraint of Office 365, and a solution for this issue has emerged as a key request from customers. We are working on a solution that will allow quicker imports of data into Exchange Online Archive Mailboxes. You will now be able to import Exchange Online data through PST files into the service without using third party tools. Drive Shipping and Network Based Ingestion options will use Azure-based services to import data. Over time we will be extending this to other data types across Office 365.

This option is not yet available on my Office 365 tenant but here is a blog post of someone who has it and has documented the process:

http://blogs.perficient.com/microsoft/2015/05/office-365-using-the-new-pst-import-service/

What excites me is not the PST stuff but this line:

Over time we will be extending this to other data types across Office 365.

That to me reads that soon Office 365 will support drive shipping and network based ingestion of SharePoint and OneDrive for Business data! That will be huge and save massive amounts of time for customers looking to move the bulk of their files and folder information to Office 365, who may also be somewhat bandwidth limited.

The second thing I note here is:

Drive Shipping and Network Based Ingestion options will use Azure-based services to import data.

That further reinforces to my mind the fact that if you are an Office 365 IT professional you are going to need to be comfortable with Azure.

To me it is no longer Office 365, it is now Office365/Azure combined as a skill set you must have going forward.

New CIAOPS Office 365 bootcamp package coming

I am working on an update to my Office 365 bootcamp notes that I plan to offer. This new product will include:

1. OneNote notebook with all the knowledge I have accumulated over the years about Office 365. It includes links and information about the product. It includes troubleshooting tips and links, it includes links to third party solutions and so much more. Basically, everything I discover about office 365 goes into this notebook every day and I USE it everyday!

2. OneNote notebook with all the knowledge I have accumulated over the years about Azure. Like the Office 365 notebook, this one contains links, tips information and more about everything Azure. Everything I discover about Azure goes into this notebook and I am using it more and more EVERY day.

3. OneNote notebook with notes designed to help you pass the Office 365 70-346 certification exam.

4 OneNote notebook with notes designed to help you pass the Office 365 70-347 certification exam.

I plan to update all of these notebooks on a regular basis and make them available as an annual subscription. Before, when you bought the bootcamp notes you only got them as a point in time publication. With the product changing so rapidly much of the information becomes obsolete and out of date so quickly.

Also, because all the notebooks continue to grow over time I need to spend some dedicated time updating and improving them. However, if I am just doing that for myself then it always seems to take a lower priority. Having them as an subscription model will give me the impetus to ensure they are as up to date and relevant as possible.

There are two ways to get access to this material:

1. You can join my Cloud Business Blueprint community via:

http://www.cloudbusinessblueprint.com/members-sign-up/

2. You can purchase the existing Office 365 bootcamp notes via;

http://www.e-junkie.com/ciaops/product/488325.php

for AU $148. This purchase will entitle you to a 12 monthly subscription to my new bootcamp notes product when it becomes available soon.

As a sweetner for option 2 (as everything offered is already part of option 1 anyway), I will also throw in, for a limited time, my:

Getting Started With Azure (valued at AU $120)

and

Getting Started with SharePoint Online Tutorial Team Site Standard Edition (valued at AU $90).

So that’s an extra AU $210 of value if you sign up today for the ‘pre-release’.

Note, this ‘pre-release’ of my new bootcamp notes product will only be available for a very limited time. As soon as I have put the finishing touches on it and launched it, then there’ll be no more sweeteners.

So many people come to me asking where they can find information about Office 365 (and now more so Azure). With this offer you can have access to the information I use in an easy to access format that you can upload to the cloud and sync and access on every device (how I do it).

As a final point, if you enjoy and obtain benefit from all the free stuff I do like this blog, my YouTube channel, my free downloads, my open sourced SharePoint Guide then I’d REALLY appreciate your support. Doing so will allow me to focus more on providing you a great solution and all the up to date information you need in one location for Office 365 and Azure.

Offline Azure backup

One of the major challenges of ANY online backup is the initial backup where all the data needs to be sent to the cloud. For most businesses there is so much data and so little bandwidth.

Like other cloud backup solutions Azure Backup also had a similar challenge when it came to the initial backup. However, if you update to the latest client you will find a new option as shown above, Offline Backup. This will allow you to take a local copy of the Azure Backup that you can then ship to the data center to be uploaded.

Once the initial offline backup has been uploaded to your Azure tenant any backup you now perform of the same data will only be the changes in the data, which is generally small. This is known as seeding the backup.

This will basically means you can now make a local copy of your data, ship that data to Microsoft and they’ll upload it to Azure for you so you avoid any bandwidth limitations when you do that first backup.

This option uses the Azure Import/Export service which you read about here:

http://azure.microsoft.com/en-us/documentation/articles/storage-import-export-service/

At the moment the Australian data centers are not listed as an option to ship data to, but I know that this option is not very far away at all, so all you folks here down under, don’t worry it won’t be long before you to can ship drives to import into Azure.

If you want to read more about the new features that are also included in this update Azure Backup Client have a look at:

http://azure.microsoft.com/blog/2015/02/16/new-features-in-azure-backup-long-term-retention-offline-backup-seeding-and-more

If you want to download the latest Azure Backup client you can do that here;

https://support.microsoft.com/en-au/kb/3033794

I use Azure Backup to backup both workstations and servers, so if you haven’t taken a look yet, I strongly suggest you do as it is a great option and really easy to configure.